1. 17 Mar, 2021 1 commit
  2. 27 Feb, 2021 1 commit
    • Douglas Anderson's avatar
      drm/msm: Fix speed-bin support not to access outside valid memory · 7bf168c8
      Douglas Anderson authored
      When running the latest kernel on an sc7180 with KASAN I got this
      splat:
        BUG: KASAN: slab-out-of-bounds in a6xx_gpu_init+0x618/0x644
        Read of size 4 at addr ffffff8088f36100 by task kworker/7:1/58
        CPU: 7 PID: 58 Comm: kworker/7:1 Not tainted 5.11.0+ #3
        Hardware name: Google Lazor (rev1 - 2) with LTE (DT)
        Workqueue: events deferred_probe_work_func
        Call trace:
         dump_backtrace+0x0/0x3a8
         show_stack+0x24/0x30
         dump_stack+0x174/0x1e0
         print_address_description+0x70/0x2e4
         kasan_report+0x178/0x1bc
         __asan_report_load4_noabort+0x44/0x50
         a6xx_gpu_init+0x618/0x644
         adreno_bind+0x26c/0x438
      
      This is because the speed bin is defined like this:
        gpu_speed_bin: gpu_speed_bin@1d2 {
          reg = <0x1d2 0x2>;
          bits = <5 8>;
        };
      
      As you can see the "length" is 2 bytes. That means that the nvmem
      subsystem allocates only 2 bytes. The GPU code, however, was casting
      the pointer allocated by nvmem to a (u32 *) and dereferencing. That's
      not so good.
      
      Let's fix this to just use the nvmem_cell_read_u16() accessor function
      which simplifies things and also gets rid of the splat.
      
      Let's also put an explicit conversion from little endian in place just
      to make things clear. The nvmem subsystem today is assuming little
      endian and this makes it clear. Specifically, the way the above sc7180
      cell is interpreted:
      
      NVMEM:
       +--------+--------+--------+--------+--------+
       | ...... | 0x1d3  | 0x1d2  | ...... | 0x000  |
       +--------+--------+--------+--------+--------+
                    ^       ^
                   msb     lsb
      
      You can see that the least significant data is at the lower address
      which is little endian.
      
      NOTE: someone who is truly paying attention might wonder about me
      picking the "u16" version of this accessor instead of the "u8" (since
      the value is 8 bits big) or the u32 version (just for fun). At the
      moment you need to pick the accessor that exactly matches the length
      the cell was specified as in the device tree. Hopefully future
      patches to the nvmem subsystem will fix this.
      
      Fixes: fe7952c6 ("drm/msm: Add speed-bin support to a618 gpu")
      Signed-off-by: default avatarDouglas Anderson <dianders@chromium.org>
      Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
      7bf168c8
  3. 23 Feb, 2021 3 commits
  4. 07 Feb, 2021 1 commit
    • Stephen Boyd's avatar
      drm/msm/dp: Add a missing semi-colon · 182b4a2d
      Stephen Boyd authored
      A missing semicolon here causes my external display to stop working.
      Indeed, missing the semicolon on the return statement leads to
      dp_panel_update_tu_timings() not existing because the compiler thinks
      it's part of the return statement of a void function, so it must not be
      important.
      
        $ ./scripts/bloat-o-meter before.o after.o
        add/remove: 1/1 grow/shrink: 0/1 up/down: 7400/-7540 (-140)
        Function                                     old     new   delta
        dp_panel_update_tu_timings                     -    7400   +7400
        _dp_ctrl_calc_tu.constprop                 18024   17900    -124
        dp_panel_update_tu_timings.constprop        7416       -   -7416
        Total: Before=54440, After=54300, chg -0.26%
      
      Add a semicolon so this function works like it used to.
      
      Cc: Sean Paul <sean@poorly.run>
      Cc: Kuogee Hsieh <khsieh@codeaurora.org>
      Cc: linux-arm-msm@vger.kernel.org
      Cc: dri-devel@lists.freedesktop.org
      Cc: freedreno@lists.freedesktop.org
      Cc: Lee Jones <lee.jones@linaro.org>
      Fixes: cc9014bf ("drm/msm/dp/dp_ctrl: Move 'tu' from the stack to the heap")
      Signed-off-by: default avatarStephen Boyd <swboyd@chromium.org>
      Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
      182b4a2d
  5. 06 Feb, 2021 1 commit
  6. 05 Feb, 2021 2 commits
  7. 04 Feb, 2021 1 commit
  8. 01 Feb, 2021 4 commits
  9. 31 Jan, 2021 26 commits